Definition

MITRE’s description of CWE-215: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Common consequences MITRE lists

  • Confidentiality: Read Application Data

Why it matters

Framework debug pages show tracebacks, settings, SQL and environment values, and some, such as the Werkzeug console, also run code.

How to prevent it

  • Turn off every framework’s debug mode in production and assert the setting in CI.
  • Keep diagnostic endpoints internal and authenticated.
  • Probe each deployment with a forced error and check the response is generic.

Guides on this site

Main subject · Guide

Ship without debug modes, verbose errors or exposed files

Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.

References

  1. CWE-215 in the MITRE CWE list (version 4.20)

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.